Please help me remove viruses/spyware!

I recently reformatted my computer, like I have many times in the past, but this time was different. It didn't entirely wipe the harddrive and I had to insert a windows xp cd to get it to boot up.

Since then my computer kept instantly restarting as my desktop loaded. It woudl do this repetedly... For hours on end. So I started in safe mode and redownloaded my anti-spyware program and was able to start it up in non-safe mode finally. I've ran hijackthis and avg so far, but I can't find where to DL a legit version of combofix.

-My computer is riddled with viruses/spyware. So much that my isp has contacted me saying that I'm spamming people and sending viruses out.
-My computer is incredibly laggy, which it shouldn't be.
-Whenever I pull up the task manager it says my cpu usage is at 100% at all times... it never used to be like that! Help me!

Double click the Vundofix.exe to run it.
Right click in the vundofix window and click add files.

Enter the following file path/s to the files you want Vundofix to delete and click the add files button, followed by the close window button:C:\WINDOWS\System32\awtsr.dll
C:\WINDOWS\SYSTEM32\igfcpl.dll

Click the remove vundo button and let Vundofix do its stuff.

Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer, click OK.
Turn your computer back on.

Thereafter, please post freshHJT, ComboFix and AVG Antispyware logs from normal mode as well as C:\vundofix.txt as attachments into this thread. The utilities can be downloaded from the links in my signature.

Regards,
Your friendly Momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

Wow, I am about to do all of that. However I feel that I should tell you taht I have taken action on the current viruses/spyware. I have quarantined them like 3 times with AVG and with Spyware Sweep...

I see. Go ahead with the recommended instructions first, and then try running your AVG scan and performing the quarantine action again.
If it prompts you for permission to quarantine the archive in which the infected file is embedded in, click ok/yes.

Regards,
Your friendly Momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by double clicking on its icon on your desktop.

Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please visit the thread in my signature and run the AVG Antirootkit tool and fix anything related to xpdt. Let me know the results (if anything else turns up in the scan, don't fix it yet)

6. Please attach the content of c:\avenger.txt into your reply, as well as a fresh HJT log and ComboFix log.

Regards,
Your friendly Momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

Next turn on "Show all files and folders, including hidden and system". See how HERE

Go to start > run and type services.msc. Press the enter key.
Search for the following services. Double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

Windows Auto Update Tool
Windows Tune service

After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):

I cannot obtain a log from AVG AntiSpyware because my computer prompts me that it is shutting down in 60 seconds and I can never finish the scan. I will include the logs of each program that I do have a log for though.

I ran AVG antiroot and it came up with nothing.

*Edit: The notification that prompts me about a system restart in 60 seconds says that my remote procedure protocal (or something along those lines) was unexpectedly terminated. It just popped up again -- "This shutdown was initiated by NT AUTHORITY\SYSTEM.

Your Combofix log shows tonnes of new random-filename-nasties everytime I check it. You have not posted the results of the AVG antirootkit scan.
I suspect something is throwing out these files and the cleaning process can take forever if we don't get to the source of this. Also, the randome forced shutdown is very likely to be part of the malware infection.

Please run AVG Antirootkit scan and let me know the results. Do a deep scan via the instructions HERE.

Also, do not use the internet for any other usage other than the forums here until your system is fully clean.

Regards,
Your friendly Momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

I'll have to run you by these instructions again, and we'll see what happens.

(Please back up your registry before you do the next step.)Go to Start > Run and type regedit. Press Enter.
Press ctrl + F and search for all instances of the following and delete them.csrs.exe
ALCXMNTR.EXE
myqughq.exe
rabblinn.dll
ipmon.exe
spoolsvc.exe
spoolvq4.exe
winIogon.exe < note its and 'i' not 'L'. winiogon.exe.

Close the program.

Please follow these instructions carefully.

1. Download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by double clicking on its icon on your desktop.

Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please attach the content of c:\avenger.txt into your reply, as well as a fresh ComboFix and HJT log.

Regards,
Your friendly Momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

Hm. That doesn't quite make sense. xpdt is an entry commonly detected by AVG antirootkit. Could you visit the preliminary removal thread link in my signature and run the antirootkit according to the instructions there once more?

Regards,
Your friendly Momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.